Analysis
-
max time kernel
37s -
max time network
149s -
platform
android_x86 -
resource
android-x86-arm-20240514-en -
resource tags
androidarch:armarch:x86image:android-x86-arm-20240514-enlocale:en-usos:android-9-x86system -
submitted
24-05-2024 10:22
Static task
static1
Behavioral task
behavioral1
Sample
6e2f768166eadc7c3c59008e4d7d76ac_JaffaCakes118.apk
Resource
android-x86-arm-20240514-en
Behavioral task
behavioral2
Sample
6e2f768166eadc7c3c59008e4d7d76ac_JaffaCakes118.apk
Resource
android-x64-arm64-20240514-en
General
-
Target
6e2f768166eadc7c3c59008e4d7d76ac_JaffaCakes118.apk
-
Size
30.7MB
-
MD5
6e2f768166eadc7c3c59008e4d7d76ac
-
SHA1
1f79376ba671cddc9440d3ca6777da9542282d41
-
SHA256
302418ca0a34fa17356ad212aac99cffefc49e004b63418841b9e57d3e43b12f
-
SHA512
0fa87c0e435f528b26b01ba3ca2c2f32b63528921de9211a1b36f21efefb40e61a01b11e27d000d7d35dad5ab4238b29d1cd97553a1611f5a20909c8ff78f767
-
SSDEEP
786432:n5U7jkppa2YGGed8nLFAdOzfySMhgztgXEqKdLgLwPk207:i7KpmDgSAdOzfpMS5CKdgLwPk24
Malware Config
Signatures
-
Checks if the Android device is rooted. 1 TTPs 1 IoCs
-
Requests cell location 2 TTPs 1 IoCs
Uses Android APIs to to get current cell location.
-
Checks CPU information 2 TTPs 1 IoCs
Checks CPU information which indicate if the system is an emulator.
-
Loads dropped Dex/Jar 1 TTPs 5 IoCs
Runs executable file dropped to the device during analysis.
Processes:
com.iyuba.voaioc pid process /data/data/com.iyuba.voa/.jiagu/classes.dex 4267 com.iyuba.voa /data/data/com.iyuba.voa/.jiagu/classes.dex!classes2.dex 4267 com.iyuba.voa /data/data/com.iyuba.voa/.jiagu/classes.dex!classes3.dex 4267 com.iyuba.voa /data/data/com.iyuba.voa/.jiagu/tmp.dex 4267 com.iyuba.voa /data/data/com.iyuba.voa/.jiagu/tmp.dex 4267 com.iyuba.voa -
Queries information about running processes on the device 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about running processes on the device.
Processes:
com.iyuba.voadescription ioc process Framework service call android.app.IActivityManager.getRunningAppProcesses com.iyuba.voa -
Queries information about the current Wi-Fi connection 1 TTPs 1 IoCs
Application may abuse the framework's APIs to collect information about the current Wi-Fi connection.
Processes:
com.iyuba.voadescription ioc process Framework service call android.net.wifi.IWifiManager.getConnectionInfo com.iyuba.voa -
Registers a broadcast receiver at runtime (usually for listening for system events) 1 TTPs 1 IoCs
Processes:
com.iyuba.voadescription ioc process Framework service call android.app.IActivityManager.registerReceiver com.iyuba.voa -
Checks if the internet connection is available 1 TTPs 1 IoCs
Processes:
com.iyuba.voadescription ioc process Framework service call android.net.IConnectivityManager.getActiveNetworkInfo com.iyuba.voa -
Listens for changes in the sensor environment (might be used to detect emulation) 1 TTPs 1 IoCs
Processes:
com.iyuba.voadescription ioc process Framework API call android.hardware.SensorManager.registerListener com.iyuba.voa
Processes
-
com.iyuba.voa1⤵
- Checks if the Android device is rooted.
- Requests cell location
- Checks CPU information
- Loads dropped Dex/Jar
- Queries information about running processes on the device
- Queries information about the current Wi-Fi connection
- Registers a broadcast receiver at runtime (usually for listening for system events)
- Checks if the internet connection is available
- Listens for changes in the sensor environment (might be used to detect emulation)
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
/data/data/com.iyuba.voa/.jiagu/classes.dexFilesize
6.2MB
MD58e80543d4e63f527196c111dee77679f
SHA1e64a80c75682da2856d3c51ac4453a3276ca9dcc
SHA2569b325ea3a90bb408e35cfc4781fcca218659245cda5554f2d678271e8e6c9c1a
SHA51279288a157cd05e298e34c8a3517c202dcf93063a9590ae7775d15a6648d739134508bec467a2cf2ad1f54f313272f19afcc7f09b234abd016d425f793368fea2
-
/data/data/com.iyuba.voa/.jiagu/classes.dex!classes2.dexFilesize
4.5MB
MD54fc20f626e00eb5cc785aa132da46d93
SHA1ac01c8dc8170bdc4a80995f8ce86f43953150d61
SHA256f1115ee60f43f511ddcbb9c5f304a43a630b7fd417edae3c01264288643decc0
SHA5127cbeda2a7b4e6df5165257433d2b4365ec0128bafe48076574c32c0dcc52d6477692ee6d2e6c58e60a6ac2bb422c3d1c954dabf0c5724ccc1f2424f5c671797b
-
/data/data/com.iyuba.voa/.jiagu/classes.dex!classes3.dexFilesize
5.8MB
MD55c2cf5a99290ec47dc50d6386b39ed00
SHA1e457ede5ba81856c7fbc447b530bf5df0adb866e
SHA256ecc781b50db24156d72fc6fbb46bc0d2995e624964cc9de6aaf90a033d1e5326
SHA512f7fee0de004e24a807575d2b4814c3bd46f9f7a7c2ee7c5d0d03c95a5dec7f4adbbc96941038a61520eef76a8952b7f7853d3d480cf6c4843a1c71da29c56050
-
/data/data/com.iyuba.voa/.jiagu/libjiagu.soFilesize
485KB
MD52c1a490890ff15348d2fc3815b2cfb3d
SHA1922e1e5539c40ad5bed578a9cea9f076df02eaee
SHA2564a272d3707e61d656a95d20b944a402a4ae39b79013e3a47a93c0faa3eefc6da
SHA5123a910269e855c3c9a31e40d2d18d166d3c3dc08bb9b063e363be8e737181389e9cc67be8d9ef8d1a63ca0500d0d028aa2562e6fb979beb1a1cccf0fe4d1d1853
-
/data/data/com.iyuba.voa/.jiagu/tmp.dexFilesize
284B
MD5f1771b68f5f9b168b79ff59ae2daabe4
SHA10df6a835559f5c99670214a12700e7d8c28e5a42
SHA2569f8898ce35a47aeafced99ea0d17c33e73037bb2307c7688e50819966f4ae939
SHA512dae27d19727b89bec49398503baa6801640540355688dfabbe689c97545295c2c2d9b0f0dcd7cbc4cfbf701d0c0c3289e647a152f49ff242d1ecc741efe4145d
-
/data/data/com.iyuba.voa/databases/basic_hds_dlpart.db-journalFilesize
512B
MD5dbbce9d5c35fa7db7a45d8ceebb4f437
SHA1411b605b08290c5cd57025aef6290a7a83ac82c2
SHA2561e9988c468c6df184f12af2b3958171d85cb7278abe94b8645e1e089bd1557eb
SHA512f6c71c56afa20baa6b8008e85de8a8c728fa599a4927c1c12771f3f09289239dd894db91542e9509beb7710c821dd501016a4452bf5b58eef212d493d4409bc1
-
/data/data/com.iyuba.voa/databases/basic_hds_dlpart.db-walFilesize
32KB
MD540e21f0b1b028ba989879ca61aea249e
SHA17cac162dd32ddddbcf7423d992b0da3d34e357b1
SHA256502449df7bb76604e0f5f1853cd3270e9e9bf9e719a256eec45ac6737fb57481
SHA512f8c5129015328584ef7c730479cbe819f9af892e094757f4049f180be2f9a666a72785d831d2469f8aca4da49ab6625e1d82eabf76d8ad9cb31e9bdf8b4f78cf
-
/data/data/com.iyuba.voa/databases/basic_hds_favorpart.db-journalFilesize
512B
MD5e2be3e24a9058e293ee7f1b40d3d6bfc
SHA1cfd8f6eb5433d752d25ec7dfe63d722e3667f1fa
SHA25667fbdf5da915f04e33c8068e3d718bd7ef7e308db7517c4f6a5db84ae048b4e9
SHA51286440470b2cb5d8f94d18bb4fbc42e025777a2e842ad2784c1173307df21e93b20f2bc28f51d32060fca86d89541a47798c862bd94c3305a39687d4fce21167c
-
/data/data/com.iyuba.voa/databases/basic_hds_favorpart.db-walFilesize
32KB
MD5d8a0e110bd92480bb0e2c34faff27499
SHA1bcab1b2780a9bf877eb702b6500c7f6839043e12
SHA2566120c094632dc37950da08f2a9a006b650dbbc20b545a49df31438f676c8d24b
SHA512f143d662fa6da39f53b07d4b87f11b338f42485eb25ca626dc2ae22aaf17d7bbc9211f412df81b47a8ee1e2651112614fbe8a350fbb164e61c19f15bab08ef4c
-
/data/data/com.iyuba.voa/databases/dictionary.dbFilesize
6.6MB
MD5ca06545f09e9e110617b933d631632ae
SHA142f6f9e62c21822603f97349533ae6b8cde8783f
SHA2568db6518a0b99953122bce34d544dfe24afac82240175709b15e8483e74fd0195
SHA5123416b79b5f75219777b5d5ce50f94153fa84cdde22ececb7c4371dbac504a8bc54211957f3c5e6092d512b28103652eae559835d6a0f852d6c2a6dfc740982de
-
/data/data/com.iyuba.voa/databases/dictionary.db-journalFilesize
4KB
MD5bb2bbf4fd3d23d7890c8f78ca69f7857
SHA19caf679d93448e0ada901038179d80d90d8a2e3c
SHA2568ad465f54b9b2c3ce9db35970079589158a1634a2de9418e1047de38f6182c45
SHA5126f00a9c471f30b4d0b7d91ff47bd63abd61d066a2a9e06e98d9fa4fa6b076b0f95e760f0b46ea3a91bcb11dcfd2ec4520b01535b6ab3d3a983673f10e16d0695
-
/data/data/com.iyuba.voa/databases/dictionary.db-walFilesize
4KB
MD5cc5b9f7325f656da63687ccc48cda736
SHA1931525f41c6e28df483556adedd46c3c99d7e33b
SHA256044207ff85c5816b5d998a88a9978299802af8ab684f6cdb5e28f83eb872505e
SHA51273f6327e9f1144e9395f61d62db551ad9eaa0e63df69e60d327122898b39f0b89b065a46fb6a2fb5e3d049be62ad2ebccaab1d2465e569d3f85149ebefca2370
-
/data/data/com.iyuba.voa/databases/download.dbFilesize
4KB
MD5f2b4b0190b9f384ca885f0c8c9b14700
SHA1934ff2646757b5b6e7f20f6a0aa76c7f995d9361
SHA2560a8ffb6b327963558716e87db8946016d143e39f895fa1b43e95ba7032ce2514
SHA512ec12685fc0d60526eed4d38820aad95611f3e93ae372be5a57142d8e8a1ba17e6e5dfe381a4e1365dddc0b363c9c40daaffdc1245bd515fddac69bf1abacd7f1
-
/data/data/com.iyuba.voa/databases/download.db-journalFilesize
512B
MD56eb65a504f336ea652225c77d4b5c254
SHA1b11f1567ce3e802348d220bdf9b0142a860212a6
SHA256198fd5f863caa0dbf01db59b513bbf4f9d7bade10fb773bbaf9c9008189bc4db
SHA5125c58b83b22e48877c83bb66b56bca1646128c1db898f088b2f516511731e119687ee57cb790ddc2586ec5460e0842df39c867406f2ebce018618598c853f607d
-
/data/data/com.iyuba.voa/databases/download.db-shmFilesize
32KB
MD5bb7df04e1b0a2570657527a7e108ae23
SHA15188431849b4613152fd7bdba6a3ff0a4fd6424b
SHA256c35020473aed1b4642cd726cad727b63fff2824ad68cedd7ffb73c7cbd890479
SHA512768007e06b0cd9e62d50f458b9435c6dda0a6d272f0b15550f97c478394b743331c3a9c9236e09ab5b9cb3b423b2320a5d66eb3c7068db9ea37891ca40e47012
-
/data/data/com.iyuba.voa/databases/download.db-walFilesize
40KB
MD5721b342002a21dec1fd5f11c4e5878e5
SHA1fda09a3e44fc63d4715645f112a98d010ccd05a0
SHA256ac66b5862fe28a37c5eda6c8b4af6af0c7abadca570b35d0e387ae59601d5f43
SHA5123c1b70e80f0b3be5c843bce2eb3112d17d59499304c8c69ba2ce9c552c5ed604bfd7dc836ec88e2b6cf6670317f7c84ed7f9026a71def1d65414e38029d85f15
-
/data/data/com.iyuba.voa/databases/headlines.db-journalFilesize
512B
MD506a17a11564c7f8fba577f0b3dca3e7f
SHA11198cb6648a5c9285899d2722643fa5e9f004cbe
SHA2569c2d60301a1653ca8bd42c8faf9e88b4598db976a85ff66ea2e365094977e243
SHA512dd594021e3256507f1ec9b17b4adff0f0568d1f05a99bd39f8e966be8e30ed708c7109c6808ea4a142753e8af09398df130810a1f9ef4aac8de6afd7db3abd79
-
/data/data/com.iyuba.voa/databases/headlines.db-walFilesize
44KB
MD52b9ce9dd4de87f09af0c82167a0f870d
SHA1bcab3dd0b66562073f11b08154f28784029df08b
SHA256e6eaeeafd8087a7d8e22a6398103281811220b7ae8c93d5c465c0b893c6b8d0e
SHA5121a26807ec2a91af6614c8900a615434bf0b8a6244683cc73befbd157f65ca471e73bdc6186d468278fbb704dfaab9722b4a5758e3d5caa1ddcd3a00535d74b77
-
/data/data/com.iyuba.voa/databases/imooc.db-journalFilesize
512B
MD5ca0c3d9192fe5f4cdfb0c0e49f4241b7
SHA1e2b228f845211d656d6f66de4cab23c1c2680615
SHA256baa1eb7f26c99f41733ee44aaeddb376a9ddc389ee5d2ec8726e6c31a668d31b
SHA5126c873b35e153648ad0e0253183520da68e63c897eb86244482979a7e9925d0589879558cf9e9a9f040f57e121844ac3f9088cf3895969d8419ebaca17a37f194
-
/data/data/com.iyuba.voa/databases/imooc.db-walFilesize
68KB
MD59671e348909bc99df9d23533d98b4c78
SHA17e2dafb6e50daa0293b719474e6e00e2de39e52e
SHA256fab54bcf4f0ab24950f415a732c6aed63822d7964ca09f1f54f21d6f61421d6b
SHA512a4250d62902e0fe46a8421ad25786a13f0217b315930c80d3d14fad36f9a429b3512d0bbc268695ff37ce68cf059433f46cfd2a8c4815eb3262dc8fb068a285a
-
/data/data/com.iyuba.voa/databases/imovies_data.db-journalFilesize
512B
MD5eb1d4091ba1846d451769edb65f95d2d
SHA1926700c9f28549c6bf1d12452c96fc2bca5b58f9
SHA25676d34beb2b0e5d2e9ae444594c3424219094a8b512265ca5f879dbea85c89bbd
SHA5124ee162090bae8900a6b331ef6aa7fcfcf16955e7940b573b45bc44ae06d35370604d5a927af8f0573950caa5ff9eeffdf2bd0082cc7f41b7f111864c0fdfe6b4
-
/data/data/com.iyuba.voa/databases/imovies_data.db-walFilesize
52KB
MD5e48b19033e5e1883fd68be56a597fa90
SHA113eba9eaf4ebccb301192b338dce7533ddafb6f6
SHA256d6082cab819ac9514f57cabc4edeff4d51fc79469ab8df14ec4df22416e04349
SHA512e16f894ba5c673b4372ee72d747e32ffb173251581603039f59ec87e09fed7dc6715bbd2b86dfbe5d22d03870f07e78d36ff082ecbd5580084e496bdac4e467e
-
/data/data/com.iyuba.voa/databases/sayings.db-journalFilesize
512B
MD5627be17bc39e39477b783ce8b22ea5c6
SHA1268ca2876efce3110cb230c8ad621821ba873686
SHA2561f29bcc0bda8d6d103e8baabc5b13864f7b15cafe99bf1ad7ce7089a0b0d0eb5
SHA5123064cf07efb48fb6fd52e6c95a2c364fc5502ba2b09bbd944724597c16254bb727da4698a8d48e41df00a0dab3b91367fee709ac7808242214b47d68c7a75f3e
-
/data/data/com.iyuba.voa/databases/sayings.db-walFilesize
52KB
MD589427a0b5475efc48bf750c42e37ca3e
SHA197ed2c3e2d97ae07f95a384396992e8729129d19
SHA256367afa21925985aefe6e9a8bab5e50b6f71d8d9d0cedc6dc00d38711976263ed
SHA5121132d0fa689cb764c223744d30280b07421a29331ea809c3e6b4c52268b1fb0ae3b16e2627c110827346b6841fc1d3aad5a3f116b9d4fa63a4b6a21946a93939
-
/data/data/com.iyuba.voa/databases/voa_database.sqlite-journalFilesize
512B
MD5851a1f0130da077fd0aebf4a04797436
SHA16f9d89ded340addcfbf520bc2f7956fe5f41ebaa
SHA25614dc79207f599fd63b0e860630137d6aaec49caf567f7c62502453961c358849
SHA512f6eef8ba4e2728ec9d3320312806154fbc3b5f892d345acbdee2d65c71f21b50663e2cbc3a6a5de076e0c8e8b4e76b0b7caed00c9e8f0515d551aaa6ffa60129
-
/data/data/com.iyuba.voa/databases/voa_database.sqlite-walFilesize
193KB
MD578075366819b1ba8b35fa3937eb272c6
SHA1148e986da4a7ed4ba45a0bc762abd8072ba857d0
SHA2565816349f03a6cce81e9f01d7030e9a1f6977f87e5044ca29ea824fb753f7123d
SHA512561b2736e11587adc2aeb8ec653f6a41e5d093ae6945be4b41b87d6d368f84c19d099525bb4b6e4679e76d9d5e566b84920b4b7c043712c36080eadb1515315b
-
/data/data/com.iyuba.voa/files/.jglogs/.jg.acFilesize
32B
MD52e32f023662e2d57fe2603294eb34495
SHA1ad72542e5cbf8884f63ce94495c040655f05d26a
SHA256cc80dc98fbcb4c2866e7c42d1205a5c0b368ff35604ca8c044b4b85bf7a0d178
SHA51292859633977fd0c921ace5c71e4b711bedc018bcf6c2ff6c2ba837c2113156dfcf55cc892c32c7c7bca429198221911165a3fc167069266e203c588a94549b25
-
/data/data/com.iyuba.voa/files/.jglogs/.jg.diFilesize
340B
MD568ea59e2fe17a59b979e866d20e7ce89
SHA102127266aa46aa56419371968d12789601979b78
SHA25681a31856d45b2678b379075d2743fd01c80e52834f639f2fd4d9c498a87a65e9
SHA512e84708b170032012dd71500a84692c1f89ae2f85abfc96976a8140e511c6aa5fc106cf00067556c593c4e9f21500a6fa5a34fb643cfb6554a076633aeaa2435d
-
/data/data/com.iyuba.voa/files/.jglogs/.jg.icFilesize
32B
MD5b1a3f4b4beb6fa03869cd7c01befdc39
SHA1d83a6db8ff610895ca4ea6ee3ee04cd9d8112d6a
SHA256602bc3c6f7f61f123f5e70d3274aaf159c433eb7204e60cf7caf910902867e56
SHA51248c11a7678b58c80aa239cb1ac1bbe4dca487f1aae7a5804da99b7360519e4fc3e3e18760bdc36240e4a2b6c21819796cf01a47f703dfae4abde8a43af5a770a
-
/data/data/com.iyuba.voa/files/.jglogs/.jg.rdFilesize
73B
MD5e2a61876eea737f863510c5c0a6f452f
SHA1654b239bb2b3140c83bef2e2fab4c66425b1fafa
SHA256be794a67770ebf0c1230e48d8d84fb4a1364896e4e7727e05ea984ef642047f3
SHA5121e976b2681b0a9c353473f7f92b7beec058e462c04f9d82b38f9b89dbc8d820303368704aa1e8a807d9c745287c287fc756b42dc97c2bc3367082f2df591e6ab
-
/data/data/com.iyuba.voa/files/.jglogs/.jg.riFilesize
314B
MD5507786b7a8c766a319ba05d99a44117a
SHA14f7ea209f236caf12824bbe5ecc1efacfa85f9be
SHA2563e666b95b8a2a319dacf8db1260f8d4b3a0a82658342ae2d3e99966ec9f01704
SHA5129cb1f7f8e0e37a8345f507a52646a645ab281cb36f205d6263ceb3ea7e874eaabd7697dd3a0e08a82630e8fe0d130649547548f8fdea00a742811241741568b3
-
/data/data/com.iyuba.voa/files/.jglogs/.jg.storeFilesize
32B
MD5448e391c59eef34ee1defbe4dee4c41f
SHA1df1f890987371d7d8e6963c68b787856e42bc146
SHA25655612e17689f4bb05f27e18b4f6d06ffef92a6a8893a5cfdd3d5b99a6028b549
SHA512ce336ce895ba861dda7da27e8869dea065eb3c3403cac55cdf1935409e5ebc95b495370f87ed7416af20af533b15615472e333ae9f2fd2713040f526835399b7
-
/data/data/com.iyuba.voa/files/.jiagu.lockFilesize
27B
MD55b97c0028d480b6b201214fc3c8e6a20
SHA193df41917a76b0419207741fb9e6ea06da14afed
SHA256f871e1ab82e0f6a79fc963c047eedb20e707698da5b775eff5e7ccf469f2cf89
SHA51290c4f0badd82e84f91cec466b97183711e99ee48373d6ce5a31e0e79e0606db736f819cba975c7935ec8f49eb4611611b5fc2617ec4fc69bd46870ee02d9d02c
-
/storage/emulated/0/360/.deviceIdFilesize
48B
MD51d8d16c4e3b19ebf18988530d9b9a757
SHA1bc94c1cce05cd848a53271ecb9c5311e27ffebf5
SHA256abd87140da8de3d0aa39a24a8d52bfe7b2eb28f7a3d505f205471c7e8f4964d7
SHA5124562d1eedbc5c2dd7f25cd1c70343053fd451026403585182b142a64f17016c1bd0bf6ad51667b439b220e425640e55fbbda08517e7106376cdc220a4555da82
-
/storage/emulated/0/360/.iddataFilesize
32B
MD5e69832a12fe55fbb65eafd0222c03f9c
SHA1afafa48aba753ee752f94f4143d38cc302fbb1c9
SHA256b1342c0722f9bef15b11e21059e68ae8e982cd950b3ad5efba854597175d39c8
SHA51234f0d8a0fc3d4e5739fc8dec273009e62fd788b8db2e47f68a3c3464265f1aa0b88a5bb037726a5cbbdd319b6794074e11be8fed712678995217a06b8024e927